Fixed #26187 -- Removed weak password hashers from PASSWORD_HASHERS.

1 files changed, 14 insertions, 5 deletions

diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index ab710fffac..47024514ca 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -2686,13 +2686,22 @@ Default::
         'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
         'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
         'django.contrib.auth.hashers.BCryptPasswordHasher',
-        'django.contrib.auth.hashers.SHA1PasswordHasher',
-        'django.contrib.auth.hashers.MD5PasswordHasher',
-        'django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher',
-        'django.contrib.auth.hashers.UnsaltedMD5PasswordHasher',
-        'django.contrib.auth.hashers.CryptPasswordHasher',
     ]
 
+.. versionchanged:: 1.10
+
+    The following hashers were removed from the defaults::
+
+        'django.contrib.auth.hashers.SHA1PasswordHasher'
+        'django.contrib.auth.hashers.MD5PasswordHasher'
+        'django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher'
+        'django.contrib.auth.hashers.UnsaltedMD5PasswordHasher'
+        'django.contrib.auth.hashers.CryptPasswordHasher'
+
+    Consider using a :ref:`wrapped password hasher <wrapping-password-hashers>`
+    to strengthen the hashes in your database. If that's not feasible, add this
+    setting to your project and add back any hashers that you need.
+
 .. setting:: AUTH_PASSWORD_VALIDATORS
 
 ``AUTH_PASSWORD_VALIDATORS``